psb_driver_load() initializes KMS polling before it attempts to initialize
backlight support. If gma_backlight_init() fails, the function returns
directly and skips psb_driver_unload(), leaving the resources allocated
earlier in probe, including KMS polling, active.
Simply using out_err is not safe: a failed backlight_device_register()
leaves an error pointer in backlight_device, which gma_backlight_exit()
would pass to backlight_device_unregister().
Move backlight cleanup to psb_device_release(), which is registered only
after successful backlight initialization, and use out_err on backlight
initialization failure. This unwinds the earlier resources without trying
to unregister a failed backlight device. Normal device release and failure
to register the managed release action retain the existing cleanup order.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 1f90b1232773 ("drm/gma500: Refactor backlight support (v2)")
Cc: [email protected]
Co-developed-by: Ijae Kim <[email protected]>
Signed-off-by: Ijae Kim <[email protected]>
Signed-off-by: Myeonghun Pak <[email protected]>
---
Changes in v2:
- Move backlight cleanup to the managed release callback so the probe
error path cannot unregister an ERR_PTR, addressing Patrik's feedback.
drivers/gpu/drm/gma500/psb_drv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index 005ab7f535..c4cc4bf5f4 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -170,7 +170,6 @@ static void psb_driver_unload(struct drm_device *dev)
/* TODO: Kill vblank etc here */
- gma_backlight_exit(dev);
psb_modeset_cleanup(dev);
gma_irq_uninstall(dev);
@@ -227,6 +226,7 @@ static void psb_device_release(void *data)
{
struct drm_device *dev = data;
+ gma_backlight_exit(dev);
psb_driver_unload(dev);
}
@@ -406,7 +406,7 @@ static int psb_driver_load(struct drm_device *dev, unsigned
long flags)
drm_connector_list_iter_end(&conn_iter);
if (ret)
- return ret;
+ goto out_err;
psb_intel_opregion_enable_asle(dev);
return devm_add_action_or_reset(dev->dev, psb_device_release, dev);
--
2.47.1
